OpenText Operations Agent privilege escalation from writable executable locations

A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability.

• Product: OpenText Operations Agent on Windows.
• Supported affected range: OA 12.22 through OA 12.29, inclusive.
• The record marks OA 12.30 as unaffected.
• The product's default_status is unaffected outside the declared affected range, but later or parallel release branches should not be assumed unaffected without separate evidence.
• The relevant package is OvEaAgt; the identified module is libopc_r.

The flaw is classified as CWE-280, involving improper handling of insufficient permissions or privileges. The affected package is OvEaAgt, with libopc_r identified as the relevant module in the affected record. Under specific conditions, Operations Agent may run executables from specific writable locations.

At a high level, a local user who can write to a relevant location may be able to cause Operations Agent to reach and run a user-controlled executable. If that process runs in a more privileged context, the result could be privilege escalation. This is a mechanism-level interpretation of the supplied description, not a complete exploitation procedure. The record does not disclose the exact trigger, the names of the writable locations, or the execution-context details of the spawned process.

The record describes local reachability with low attack complexity and low privileges required. The OpenText assessment describes user interaction as passive, while the separate NVD assessment records no user interaction; this difference should not be silently collapsed into a single condition.

The supplied record does not identify a public exploit and does not mark the issue as known exploited. That means no public exploit is identified in the available data, not that real-world exploitation has been ruled out. The record provides no evidence that the flaw is remotely exploitable.

Successful exploitation could allow a low-privilege local user to cause Operations Agent to run code in a more privileged context. The resulting technical consequences could include loss of confidentiality, unauthorized integrity changes, and loss of availability on the host or related services, consistent with the supplied impact characteristics.

The flaw is described as local; the record does not establish remote exploitation, cross-host propagation, or impact beyond the affected host. The practical outcome depends on the specific conditions, the privileges held by the Operations Agent process, and the locations the agent can access.

An affected Windows host could be used to execute code with higher privileges through Operations Agent. This may enable unauthorized changes to protected files or settings, access to data available to the elevated context, or disruption of services that depend on the agent.

The operational risk is concentrated on Windows hosts where a local user or local process can write to a location used by Operations Agent to run executables. The supplied evidence does not identify a breach, victim, or campaign; that absence should not be interpreted as evidence that exploitation has not occurred.

1. Apply the OpenText hotfix for the installed branch and follow the instructions in the included readme.txt.
2. The packages listed in the record are:

• OA 12.24: HFWIN_1224028.tar, HFWIN_1224029.tar
• OA 12.25: HFWIN_1225045.tar, HFWIN_1225046.tar
• OA 12.26: HFWIN_1226039.tar, HFWIN_1226040.tar
• OA 12.27: HFWIN_1227023.tar, HFWIN_1227024.tar
• OA 12.28: HFWIN_1228020.tar, HFWIN_1228021.tar
• OA 12.29: HFWIN_1229006.tar, HFWIN_1229007.tar

1. For OA 12.22 and OA 12.23, the record confirms affected status but does not list corresponding hotfix filenames. Obtain branch-specific guidance or a package from OpenText; do not assume that a package listed for another branch applies.
2. If inventory confirms OA 12.30, the record marks that branch as unaffected. The status of other release branches still requires separate verification.

1. Inventory Windows hosts running OpenText Operations Agent and identify the OvEaAgt package and libopc_r module.
2. Compare the installed product branch with OpenText's listed hotfixes and verify hotfix installation through software-management records or deployment tooling.
3. Review ACLs and deployment settings for locations that Operations Agent can use to find or run executables. The record does not name the locations, so this is a precautionary review rather than a confirmed IOC check.
4. As additional monitoring, review process-creation telemetry for Operations Agent launching executables from writable directories. The record does not provide a specific log event or IOC.
5. Investigate unusual child processes launched by Operations Agent and unauthorized changes in relevant execution locations. Absence of suspicious log evidence should not be treated as proof that a host is safe.